Why Does Cyber Essentials Certification Take So Long? It Does Not Have To.

The time to a Cyber Essentials certificate has two parts: preparing a complete, compliant self-assessment, then the certification body's review and issue process. Clarification or remediation can extend the first part. Fig Group publishes a conditional six-working-hour Basic certification guarantee for the second part; the certification terms define its start and cutoff.

If a buyer has given you a tender deadline, ask each body for its written clock, not just an estimated end-to-end date. A provider may return first feedback quickly while a control gap still needs days to fix. An applicant may be ready immediately and wait for assessor capacity. Those are different causes of delay.

For the full preparation timeline, see How long does Cyber Essentials take?. For Fig Group's service conditions, see fast Cyber Essentials certification.

Preparation and scope. List the legal entity, devices, cloud services and any organisation-issued remote-worker routers. Check the account version and answer against the applicable question set. If software is unsupported or MFA is missing on an in-scope cloud service, fixing that control takes time regardless of provider.

Submission review. An assessor checks the answers and may request clarification. A body can use structured intake and available staff to shorten its own queue. The public market does not provide a reliable universal 24–72-hour or 5–15-day baseline, so request a current written commitment for the package you intend to buy.

Feedback and resubmission. Specific written feedback helps an applicant identify what to correct. Fig Group includes three feedback rounds under its published terms. A feedback entitlement is separate from a promise that a non-compliant submission will be certified within the guarantee window.

Certificate issue. Once the applicable assessment passes, check the certificate's named entity, scope, issue and expiry dates. Use the IASME certificate search for independent verification.

The Basic guarantee is within six working hours after receipt of a complete, compliant submission before midday UK time on a UK Business Day, subject to the certification terms. Purchase, questionnaire completion, remediation and Cyber Essentials Plus technical testing are separate. A body may offer a different service clock for a different package or organisation size; compare the actual written terms.

A structured workflow can make intake, assessor allocation and feedback more efficient. Specific claims about queue-free processing, minute-by-minute AI triage or an observed percentage of submissions require operational records; they are not necessary to understand the published guarantee.

For MSP portfolios, plan client submissions against their individual readiness, approval and renewal dates. Ten clients do not automatically become ten certificates in one day, even when a body offers a short clock on each compliant submission. Agree responsibilities and escalation for each client.

1. Confirm that the buyer accepts Basic or requires Plus and which legal entity and scope must be certified.

2. Check your controls and allow time to correct any gap.

3. Compare written assessment clocks, feedback terms and UK business-day cutoffs for equivalent packages.

4. Submit with enough time for clarification, certificate verification and any buyer checks.

Fig Group publishes a fast, conditional Basic route from £299.99 + VAT for Micro. The shortest useful timeline is the one that accounts for your preparation as well as the assessor's service level.